Switchable authorization checks for RFC in Conditions Master Data, SAP security note 2272055

SAP security note 2272055, "Switchable authorization checks for RFC in Conditions Master Data". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This SAP note describes new switchable authorization checks for RFC function modules in Conditions Master Data external interface.

Solution

New switchable authorization checks have been implemented. The checks are delivered inactive to ensure compatibility with your running processes. The checks can be activated in transaction SACF as described in the attached manual correction instruction. See note 1922808 for additional information on the switchable authorization check framework (SACF).

• New authorization scenario: CRM_COND_XIF, authorization check for Conditions XIF RFC Modules, using authorization object /SAPCND/CM
• Affected RFC function module CRMXIF_COND_REC_COMPL_SAVE, authorization object /SAPCND/CM, ACVTC=02
• Affected RFC function module CRMXIF_CONDITION_RECORD_SAVE, authorization object /SAPCND/CM, ACVTC=02
• Affected RFC function module CRMXIF_CONDITION_SCALE_SAVE, authorization object /SAPCND/CM, ACVTC=02
• Affected RFC function module CRMXIF_CONDITION_SEL_DELETE, authorization object /SAPCND/CM, ACVTC=02
• Affected RFC function module CRMXIF_COND_REC_SLIM_SAVE, authorization object /SAPCND/CM, ACVTC=02
• Create the authorization scenario definition in transaction SACF (upload CRM_COND_XIF.txt via SACF_TRANSFER if it does not exist) and assign it to development package CRMXIF_CONDITION_TECHNIQUE
• Transfer the scenario definition to a productive scenario in SACF, choosing status Active or Logging
• Activate logging of SACF-relevant audit messages in the Security Audit Log via transaction SM19
• Adjust roles to provide the necessary authorizations, using report RSAU_SELECT_EVENTS

Reason and prerequisites

Remote calls to RFC function modules are protected by checks on the authorization object S_RFC. Authorizations for S_RFC must be limited to the required minimum authorizations for all users to ensure system security. Many RFC function modules can be sufficiently protected using S_RFC authorization checks. These RFC function modules often do not perform additional functional authorization checks. Please see SAP note 2008727 for further information on RFC Security.

It was identified that S_RFC authorization checks might not be sufficient to ensure secure execution for RFC function modules covered by this note. Activate new switchable authorization checks and update corresponding roles if these RFC function modules are included in S_RFC authorizations in your system.

References

• SAP Note 2236076 – Architectural change to avoid syntax errors when calling CL_RFC=>CHECK_EXTERNAL and CL_SACF=>AUTH_CHECK_SPEC

Affected components

• BBPCRM 700
• BBPCRM 701
• BBPCRM 702
• BBPCRM 712
• BBPCRM 713
• BBPCRM 714